[RFC PATCH 08/13] powerpc/dexcr: Add enforced userspace ROP protection config
From: Benjamin Gray <hidden>
Date: 2022-11-28 02:46:15
Also in:
linux-hardening, lkml
Subsystem:
linux for powerpc (32-bit and 64-bit), the rest · Maintainers:
Madhavan Srinivasan, Linus Torvalds
The DEXCR Non-Privileged Hash Instruction Enable (NPHIE) aspect controls whether the hashst and hashchk instructions are treated as no-ops by the CPU. NPHIE behaviour per ISA 3.1B: 0: hashst and hashchk instructions are executed as no-ops (even when allowed by PCR) 1: hashst and hashchk instructions are executed normally (if allowed by PCR) Currently this aspect may be set per-process by prctl() or enforced globally by the hypervisor. Add a kernel config option PPC_USER_ROP_PROTECT to enforce DEXCR[NPHIE] globally regardless of prctl() or hypervisor. If set, don't report NPHIE as editable via prctl(), as the prctl() value can never take effect. Signed-off-by: Benjamin Gray <redacted> --- arch/powerpc/Kconfig | 5 +++++ arch/powerpc/kernel/dexcr.c | 15 +++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 699df27b0e2f..ba3458d07744 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig@@ -434,6 +434,11 @@ config PGTABLE_LEVELS default 2 if !PPC64 default 4 +config PPC_USER_ROP_PROTECT + bool + depends on PPC_BOOK3S_64 + default y + source "arch/powerpc/sysdev/Kconfig" source "arch/powerpc/platforms/Kconfig"
diff --git a/arch/powerpc/kernel/dexcr.c b/arch/powerpc/kernel/dexcr.c
index 8239bcc92026..394140fc23aa 100644
--- a/arch/powerpc/kernel/dexcr.c
+++ b/arch/powerpc/kernel/dexcr.c@@ -2,6 +2,7 @@ #include <linux/capability.h> #include <linux/cpu.h> #include <linux/init.h> +#include <linux/kconfig.h> #include <linux/prctl.h> #include <linux/sched.h> #include <linux/spinlock.h>
@@ -18,8 +19,8 @@ #define DEFAULT_DEXCR 0 /* Allow process configuration of these by default */ -#define DEXCR_PRCTL_EDITABLE (DEXCR_PRO_SBHE | DEXCR_PRO_IBRTPD | \ - DEXCR_PRO_SRAPD | DEXCR_PRO_NPHIE) +static unsigned long dexcr_prctl_editable __ro_after_init = + DEXCR_PRO_SBHE | DEXCR_PRO_IBRTPD | DEXCR_PRO_SRAPD | DEXCR_PRO_NPHIE; /* * Lock to protect system DEXCR override from concurrent updates.
@@ -83,6 +84,12 @@ static int __init dexcr_init(void) if (early_cpu_has_feature(CPU_FTR_DEXCR_SBHE)) update_userspace_system_dexcr(DEXCR_PRO_SBHE, spec_branch_hint_enable); + if (early_cpu_has_feature(CPU_FTR_DEXCR_NPHIE) && + IS_ENABLED(CONFIG_PPC_USER_ROP_PROTECT)) { + update_userspace_system_dexcr(DEXCR_PRO_NPHIE, 1); + dexcr_prctl_editable &= ~DEXCR_PRO_NPHIE; + } + return 0; } early_initcall(dexcr_init);
@@ -131,7 +138,7 @@ static int dexcr_aspect_get(struct task_struct *task, unsigned int aspect) { int ret = 0; - if (aspect & DEXCR_PRCTL_EDITABLE) + if (aspect & dexcr_prctl_editable) ret |= PR_PPC_DEXCR_PRCTL; if (aspect & task->thread.dexcr_mask) {
@@ -174,7 +181,7 @@ int dexcr_prctl_get(struct task_struct *task, unsigned long which) static int dexcr_aspect_set(struct task_struct *task, unsigned int aspect, unsigned long ctrl) { - if (!(aspect & DEXCR_PRCTL_EDITABLE)) + if (!(aspect & dexcr_prctl_editable)) return -ENXIO; /* Aspect is not allowed to be changed by prctl */ if (aspect & task->thread.dexcr_forced)
--
2.38.1